Law note · Iceland
Act No. 90/2018, Persoonuvernd Enforcement in Iceland
Persoonuvernd holds investigative and corrective powers and administrative-fine authority.
Because General Data Protection Regulation (GDPR) reaches Iceland through national legislation rather than direct EU regulation applicability, Act No. 90/2018 sets Iceland's fine ceiling in Icelandic krona rather than by direct reference to the EUR-denominated GDPR figures; two independent secondary sources converge on a lower tier around ISK 1.2 billion or 2 percent of global turnover and a higher tier around ISK 2.4 billion or 4 percent, mirroring the GDPR Article 83(4)/(5) structure, alongside daily compulsion fines and a criminal-penalty track for deliberate breaches.
The specific ISK figures were not independently confirmed against the Act's own fine-setting section this pass. Individuals may seek compensation for material or non-material damage, mirroring GDPR Article 82.
What it asks of an app
- Expect Persoonuvernd to have jurisdiction and fining power, denominated in Icelandic krona at a level converging with the General Data Protection Regulation (GDPR) Article 83 tiers, over your processing of personal data of a person in Iceland.
- Expect any person who suffered material or non-material damage from an infringement to have a right to compensation from you as controller or processor, under Act No. 90/2018.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, high_risk_decisions, processes_biometrics, processes_voice